PT-2023-30664 · WordPress · Dologin Security

Name of the Vulnerable Software and Affected Versions: DoLogin Security WordPress plugin versions prior to 3.7.1 Description: The issue concerns the DoLogin Security WordPress plugin, which does not restrict access to a widget showing IPs of failed logins to low-privileged users. This could...

WordPress DoLogin Security Plugin < 3.7 is vulnerable to Cross Site Scripting (XSS)

Software DoLogin Security Type Plugin Vulnerable versions 3.7 Fixed in 3.7 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-4549 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID ea7d8ad59ce2 Credits Bartlomiej Marek and...

CVE-2023-4631

The DoLogin Security WordPress plugin before 3.7 uses headers such as the X-Forwarded-For to retrieve the IP address of the request, which could lead to IP spoofing...

Cross site scripting

The DoLogin Security WordPress plugin before 3.7 does not properly sanitize IP addresses coming from the X-Forwarded-For header, which can be used by attackers to conduct Stored XSS attacks via WordPress' login form...

CVE-2023-4549

CVE-2023-4549 concerns the DoLogin Security WordPress plugin, affected versions prior to 3.7. The vulnerability stems from improper sanitization of IPs from the X-Forwarded-For header, enabling a stored Cross-Site Scripting (XSS) attack through WordPress’ login form. Public references in the prov...

CVE-2023-4631 DoLogin Security < 3.7 - IP Spoofing

The DoLogin Security WordPress plugin before 3.7 uses headers such as the X-Forwarded-For to retrieve the IP address of the request, which could lead to IP spoofing...

CVE-2023-4631 DoLogin Security < 3.7 - IP Spoofing

The DoLogin Security WordPress plugin before 3.7 uses headers such as the X-Forwarded-For to retrieve the IP address of the request, which could lead to IP spoofing...

PT-2023-29951 · WordPress · Dologin Security

Name of the Vulnerable Software and Affected Versions: DoLogin Security WordPress plugin versions prior to 3.7 Description: The issue allows IP spoofing by using headers such as the X-Forwarded-For to retrieve the IP address of the request. Recommendations: For versions prior to 3.7, update to...

WordPress plugin DoLogin Security security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blog sites on servers running PHP and MySQL.WordPress plugin i...

WordPress plugin DoLogin Security Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blogs on PHP and MySQL servers.WordPress plugin is an...

DoLogin Security < 3.7.1 - Subscriber+ IP Address leak

Description The plugin does not restrict the access of a widget that shows the IPs of failed logins to low privileged users. PoC Just login to subscriber account and go to: http://localhost/wp-admin/index.phplog...

DoLogin Security < 3.7.1 - Subscriber+ IP Address leak

Description The plugin does not restrict the access of a widget that shows the IPs of failed logins to low privileged users. Just login to subscriber account and go to: http://localhost/wp-admin/index.phplog...

DoLogin Security < 3.7 - IP Spoofing

Description The plugin uses headers such as the X-Forwarded-For to retrieve the IP address of the request, which could lead to IP spoofing. PoC 1. Send login request with x-forwarded-for: REDACTEDIP 2. See spoofed IP address in the "Login Attempts Log"...

WordPress DoLogin Security Plugin <= 3.6 is vulnerable to Bypass Vulnerability

Software DoLogin Security Type Plugin Vulnerable versions = 3.6 Fixed in 3.7 OWASP Top 10 A4: Insecure Design Classification Bypass Vulnerability CVE N/A Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID e4651ef4e7a2 Credits WordFence Required privilege Unauthenticated...